Bank Fraud

born_again

Carlyxx said:

born_again said:

soolin said:

Carlyxx said:

Thank you for your response. There were over 20 online purchases, various sites. I was at work when this happened and the card, although it has now been cancelled, was in my possession. No one else has access to my accounts etc. 

Online purchases - so potentially the scammer has access to your log in details for your bank. Does anyone else have your details- and do you use a card reader or any other form of 2 line log in?

Why do people think online purchases (card payments) involve online login details?
All they need is the card number.

IP address can be checked, but that will only depend on how the payments are made. And Ip's are very much like you post code. Do not relate to your actual address.

In reality these should have been refunded straight away. PSD states that unless their is reasonable proof of customer involvement, and with online purchases that is not possible to prove straight away. Then you should have the refund, but it could be reversed later on.

Hi, what is PSD? I just don’t know what to do. 

Payment Services Directive. 
Any fraud rep will know all about it and what they have to do.

born_again

colsten said:

born_again said:

IP address can be checked, but that will only depend on how the payments are made. And Ip's are very much like you post code. Do not relate to your actual address.

IP addresses don't depend on how payments are made. They are very different to post codes, in that your post code is static unless you move, whereas your IP address is dynamic and can / does change without you even noticing, even if you are in physically the same place always. For example, my current IP is in Manea, Cambridgeshire. I haven't been in Cambridgeshire, or any adjacent county, in years. Check yours on https://www.iplocation.net/

For a bank to get a IP address on a card payment it is.
They can only get them from VbV/Mastercard secure system. Any that do not go through that require a retailer to supply them. Which can take a long time..
Post code analogy was a very simple explanation. Many people feel a IP address is a rock solid proof of location. As you said it's not.

Teapot55

I have always worried about paying over the phone using my debit card when they ask for the three numbers on the back of the card. 

born_again

Teapot55 said:

I have always worried about paying over the phone using my debit card when they ask for the three numbers on the back of the card. 

Why? It's not different to typing it in a website.
They can not store the number & it proves you have the card in your hand (hopefully)

Eco_Miser

born_again said:

Teapot55 said:

I have always worried about paying over the phone using my debit card when they ask for the three numbers on the back of the card. 

Why? It's not different to typing it in a website.
They can not store the number & it proves you have the card in your hand (hopefully)

A person answering a phone is capable of remembering a 3 digit number, and possibly storing it, along with the card number, on a piece of paper. A website could do similar, but that action would be visible in the source code for auditors to find. 

dggar

colsten said:

born_again said:

IP address can be checked, but that will only depend on how the payments are made. And Ip's are very much like you post code. Do not relate to your actual address.

IP addresses don't depend on how payments are made. They are very different to post codes, in that your post code is static unless you move, whereas your IP address is dynamic and can / does change without you even noticing, even if you are in physically the same place always. For example, my current IP is in Manea, Cambridgeshire. I haven't been in Cambridgeshire, or any adjacent county, in years. Check yours on https://www.iplocation.net/

Did a google search for "iplocation" 
The first three sites each gave a different answer,
 no of which were correct

SpreadableToast

dggar said:

colsten said:

born_again said:

IP address can be checked, but that will only depend on how the payments are made. And Ip's are very much like you post code. Do not relate to your actual address.

IP addresses don't depend on how payments are made. They are very different to post codes, in that your post code is static unless you move, whereas your IP address is dynamic and can / does change without you even noticing, even if you are in physically the same place always. For example, my current IP is in Manea, Cambridgeshire. I haven't been in Cambridgeshire, or any adjacent county, in years. Check yours on https://www.iplocation.net/

Did a google search for "iplocation" 
The first three sites each gave a different answer,
 no of which were correct

So you're agreeing with what colsten said then.

dggar

SpreadableToast said:

dggar said:

colsten said:

born_again said:

IP address can be checked, but that will only depend on how the payments are made. And Ip's are very much like you post code. Do not relate to your actual address.

IP addresses don't depend on how payments are made. They are very different to post codes, in that your post code is static unless you move, whereas your IP address is dynamic and can / does change without you even noticing, even if you are in physically the same place always. For example, my current IP is in Manea, Cambridgeshire. I haven't been in Cambridgeshire, or any adjacent county, in years. Check yours on https://www.iplocation.net/

Did a google search for "iplocation" 
The first three sites each gave a different answer,
 no of which were correct

So you're agreeing with what colsten said then.

Absolutely agreeing with colsten. Did something give you the impression that I wasn't?

nyermen

HSBC now send a text message with a code to enter, to confirm online purchases.
Unless - they somehow detect you're all good.   I'd always assumed it was well known companies, but I bought something from a new site last week and they didn't do the text message thing, so i guess it must be location or even exact IP.  Either your IP is static and never changes, or it may be dynamic, but what are the odds of a fraudster getting a dynamic IP the same as yours (unless they can spoof it?).  I guess that's HSBC's starting point. 
Personally I think they should do the code every time, it doesn't take a moment.

colsten

nyermen said:

HSBC now send a text message with a code to enter, to confirm online purchases.
Unless - they somehow detect you're all good.   I'd always assumed it was well known companies, but I bought something from a new site last week and they didn't do the text message thing, so i guess it must be location or even exact IP.  Either your IP is static and never changes, or it may be dynamic, but what are the odds of a fraudster getting a dynamic IP the same as yours (unless they can spoof it?).  I guess that's HSBC's starting point. 
Personally I think they should do the code every time, it doesn't take a moment.

Randomness in checking transactions is goodness, as this makes it massively more difficult for fraudsters. It's also less disruptive for consumers if their transaction is 'trusted'.

If there were 'a code every time', it wouldn't be long before fraudsters found a way to figure out a way to make use of the code.